skillopt-sleep

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). SKILL.md describes a runtime workflow that “Harvest” reads past Claude Code session JSONL and history files from ~/.claude/... and then uses those digests as inputs to offline replay/consolidation, which would include outsider-authored free text from other participants in those transcripts (e.g., messages/comments not authored by the operating user).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly performs state-changing actions: it can install nightly cron entries via the "schedule" command and can "adopt" staged proposals by copying staged files over live ones (with backups), so it directs the agent to modify the host environment and file system.